Hydraulic control systems are commonly used to control power generation machines, such as turbines. Known hydraulic control systems may include a trip control system or other protection system configured to stop the turbine (i.e., trip the turbine) upon the detection of an abnormal operating condition or other system malfunction. Unfortunately, the failure of one or more components associated with the trip control system to operate properly can prevent a turbine trip operation from occurring during emergency situations, which can lead to extensive damage to the turbine as well as other catastrophes, such as harm or injury to plant personnel.
Existing emergency trip systems such as, for example, the mechanical emergency trip system manufactured by General Electric Company (GE), include several components (e.g., valves, governors, blocks, ports, etc.) piped together to form a mechanically operated trip system. In a purely mechanical version, block and bleed functions are performed using non-redundant hydraulically actuated valves. However, in some cases, this system has been retrofit to include electronically controlled redundant bleed valves that perform a bleed operation to dump or remove pressure from a steam valve trip circuit that operates the turbine based on a two-out-of-three voting scheme. Once a bleed operation is performed, however, the GE mechanical trip system requires that the delivery of hydraulic fluid to the control port of the steam valve be blocked. Such a mechanical system results in a large, complex design having separate parts that may be expensive to manufacture. Additionally, the GE mechanical trip system requires an operator to manually perform tests of the blocking components. Still further, the mechanical nature of the blocking system of the GE mechanical trip system requires that an operator travel to the site of the turbine, which is undesirable.
While automatic trip systems have been developed in which the mechanical governor and associated linkages are replaced with a controller that automatically performs a trip operation, such automatic tripping systems typically include single, isolated valves or are limited to the bleed functionality of the tripping system. In particular, as described above with respect to the retrofit GE turbine system, it is known to use a set of three control valves connected to a controller to perform a two out of three voting scheme for performing a bleed function within a turbine trip control system. In this configuration, each of the control valves operates two DIN valves which are connected to one another in a manner that assures that, if two out of the three control valves are open, a hydraulic path is created through a set of two of the DIN valves to cause pressure to be bled from the trip port of the steam valve that provides steam to the turbine. The loss of pressure at the trip port of the steam valve closes the steam valve and trips or halts the operation of the turbine. With this configuration, the failure of any one of the control valves will not prevent a trip operation from being performed when desired or required and likewise, will not cause a trip to occur when such a trip is not desired. Additionally, because of the two out of three voting scheme, the individual components of this bleed circuit can be tested while the turbine is in operation without causing a trip to occur.
Unfortunately, the block circuit or block portion of a trip control system is an important part of the control circuit and, in many systems, there is no manner of being able to provide redundancy in the block circuit to assure proper operation of the block circuit if one of the components thereof fails, and no manner of electronically testing or operating the block circuit. In fact, the block circuit of many known turbine trip control systems must be operated manually, which is difficult to do as it requires an operator to go to and actually manually operate components of the block circuit (generally located near the turbine) after the bleed portion of the trip operation has occurred. Likewise, in systems that use manually operated components, there is no simple remote manner of testing the operation of the block portion of the trip control system.
In an attempt to address many of the shortcomings of these systems, U.S. Pat. No. 7,874,241 discloses a trip control system for use with, for example, turbines, that includes a block circuit having two or more redundant blocking valves connected in series within a pressure supply line to block the supply of hydraulic fluid within the pressure supply line and a bleed circuit having two or more bleed valves connected in parallel between the trip line and a return or dump line to bleed to the hydraulic fluid from the trip. The blocking valves and the bleed valves are actuated by one or more control valves under control of a process or safety controller which operates to cause a trip by first performing a bleed function using at least one of the bleed valves and then a block function using at least one of the blocking valves. Additionally, pressure sensors are disposed at various locations within the tripping control system and provide feedback to the controller to enable the controller to test each of the blocking and bleed valves individually, during operation of the turbine, without causing an actual trip of the turbine. In this manner, the trip control system of U.S. Pat. No. 7,874,241 provides reliable trip operation by providing redundant block and bleed functionality in combination with enabling the individual components of the block and bleed circuits to be tested while the turbine is online and operating but without preventing the turbine from being tripped, if necessary, during the test.
While the trip control system disclosed in U.S. Pat. No. 7,874,241 overcomes some of the problems with known trip control systems, it still has some shortcomings. In particular, while the trip control system described in U.S. Pat. No. 7,874,241 can be used to detect faulty solenoids or valves within the bleed circuit while operating on-line, the faulty components of the bleed circuit cannot be repaired or replaced until the turbine system is shut down or otherwise put out of service, making repair of the faulty components harder to implement. Additionally, the trip control system of U.S. Pat. No. 7,874,241 provides pressure from a pressure line to the trip valves and to trip header lines via orifices which must be sized to provide sufficient pressure at the trip header line during normal operation of the turbine to prevent a trip, while being small enough not to bleed a lot of oil (or other hydraulic fluid) from the pressure line to the trip header line and then to the drain or tank when a trip has been engaged. The use and sizing of these orifices, and therefore the operation of these orifices, always involves a trade-off of performance when in the normal operating state versus the tripped state. Moreover, the trip control system described in U.S. Pat. No. 7,874,241 includes manifolds that require various oil lines to be coupled thereto with tubes and fittings, leading to a system that is harder to install and configure, as well as one that has a lot of failure points with respect to the oil supply.